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Abstract 

We study the function Q(x, y, z) that counts the number of positive 
integers n < x which have a divisor d > z with the property that p < y 
for every prime p dividing d. We also indicate some cryptographic 
applications of our results. 

1 Introduction 

For every integer n > 2, let P + (n) and P~(n) denote the largest and the 
smallest prime factor of n, respectively, and put P + (l) = 1, = oo. For 

real numbers x, y > 1, let ^(x, y) and &(x,y) denote the counting functions 
of the sets of y-smooth numbers and y-rough numbers, respectively; that is, 

W(x,y) = #{n<x : P + (n) < y}, 
$(x,y) = #{n < x : P~{n) > y}. 
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For a very wide range in the xy-plane, it is known that 



ty(x, y) ~ g(u) x 



and 



${x,y) 




x 



logy 



where u denotes the ratio (log x)j logy, is the Dickman function, and 
u(u) is the Buchstab function; the definitions and certain analytic properties 
of q{u) and u;(m) are reviewed in Sections 121 and El below. 

In this paper, our principal object of study is the function Q(x, y, z) that 
counts positive integers n < x for which there exists a divisor d \ n with 
d > z and P + {d) < y; in other words, 



where n y denotes the largest y-smooth divisor of n. The function Q(x,y,z) 
has been previously studied in the literature; see [TJ EJ |S] . 

For x, y, z varying over a wide domain, we derive the first two terms of 
the asymptotic expansion of 0(s, y, z). We show that the main term can be 
naturally defined in terms of the partial convolution C W)Q (u, v) of g with u, 
which is defined by 



Using precise estimates for ty(x,y) and $>(x, y), we also identify the second 
term of the asymptotic expansion of Q(x,y, z), which is naturally expressed 
in terms of the partial convolution C Uje r(u,v) of g' with to: 



We use this formula to give a heuristic prediction for the density of certain 
integers of cryptographic interest which appear in 0. An alternative ap- 
proach, which establishes a two term asymptotic formula for Q(x,y,z) over 
a wider range, has been developed recently by Tenenbaum jHj. 

Theorem 1. For fixed e > and uniformly in the domain 

x > 3, y > exp{(log logx) 5 ^ 3+£ }, ylogy < z <x/y, 



@0, V, z) = (g(u) + C Wie {u, v))x-"/ C u j (u, v) \-0(£ (x, y, z)) , 



Q(x,y,z) = #{n < x : n y > z}, 





we have 
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where u = (log x)/ logy, v = (log z)j logy, 7 zs i/ie Euler-Mascheroni con- 
stant, and 

£{x , y , z) = Alg(--i) + g( " )1 ° 8( " + 1) + eW 



logy [ logy log(u + 1) 

The proof of Theorem^ is given below in Section HJ our principal tools are 
the estimates of Lemma|U(Section|2j and LemmaE] (Section OJ). In Section^ 
we outline some cryptographic applications of our results. 
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2 Integers free of large prime factors 

In this section, we collect various estimates for the counting function ty(x, y) 
of y -smooth numbers: 

ty(x,y) = #{n < x : P + (n) < y}. 

As usual, we denote by g(u) the Dickman function; it is continuous at u = 1, 
differentiable for u > 1, and it satisfies the difference-differential equation 

uq'{u) + q{u - 1) = («>1) (1) 

along with the initial condition 

q{u) = 1 (0 < u < 1). 

It is convenient to define g(u) = for all u < so that (JTJ is satisfied for 
a 6 K\{0, 1}, and we also define q'{u) by right-continuity at u = and 
u — 1. For a discussion of the analytic properties of g(u), we refer the reader 
to Chapter III.5]. 

We need the following well known estimate for \l/(x,y), which is due to 
Hildebrand [2] (see also (HI Corollary 9.3, Chapter III. 5]): 
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Lemma 1. For fixed e > and uniformly in the domain 
x>3, x > y > exp{(logloga;) 5/3+£ }, 

we have 

where u = (log x)j logy. 

We also need the following extension of Lemma ^ which is a special case 
of the results of Saias 0: 

Lemma 2. For fixed e > and uniformly in the domain 

x > 3, y > exp{(loglogx) 5/,3+e }, x>ylogw, 
i/ie following estimate holds: 

V(x, y) = g(it) a; + (7 - l)g'(u) + O ( g"(u)-^- j , 

logy V log y/ 

where u = (log x)/ logy. 

The following lemma provides a precise estimate for the sum 

S(y,z)= d 

d>z 
P+(d)<y 

over a wide range, which is used in the proofs of Lemmas 0] and |H1 below. The 
sum S(y,z) has been previously studied; see, for example, [7j. 

Lemma 3. For fixed e > and uniformly in the domain 
y > 3, 1 < z < expexp{(logy) 3/5 ~ £ }, 

we have 

3(y,z) = r(v)\ogy -7q(v) + 0(E(y,z)), 
where v = (log z) / log y, 

POD 

r(v) = / g(s)ds, 

Jv 
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and 



E(y,z) 



' g(v) \og(v + 1) 
logy 



if z > ylogy; 



_i . loglogy 
z + — ifz<y\ogy. 



logy 



Proof. Let Y = ylogy. First, suppose that z > Y, and put 

exp{(log|/) 3/ ' 5 " £/ ' 2 } 



T 



logy 



By partial summation, it follows that 



d 

z<d<y T 
P+(d)<y 

_ ^(y T ,y) V(z,y) 
y T z 

By Lemma H we have the estimate 
*(z,y) 



+ logy 



^{y\y) 



y 



ds + S{y,y 



T 



q(v) + O 



Also, by our choice of T we have 

®{y T ,y) 



y u 



< q(T) < 



q{v) log{v + I) 
logy 

q(v) log(v + 1) 
logy 



The following bound is given in the proof of Corollaire 2]: 

S(y,y T )= £ -,«Q(Ty T + y -^ T , 



d>y T 
P+(d)<y 



from which we deduce that 

%,</')< 



logy 



To estimate the integral in (0), we apply Lemma El and write 

' T ^(y s ,y) 



I 

J V 



y 



ds = h+I 2 + 0{h), 



where 



h = J q{s) ds = t(v) - r(T), 

log?/ J v logy 

1 [ T n, ^ , S'(T) - e '{v) 



-T 

hi \ j f V" 

[ S I fit.S = 

log y 

Since x Q( v ) log(t> + 1), and 



1 r 

J 3 = —j- / Q (s) ds - , 

log y y„ 



T(r) « Q(T) « + D , 

log y 

it follows that 

T ^1 ds = r(„) - (7 T 1)g(t;) + O f^ lQ f + 1 ^ . (5) 

r logy V iog 2 y / 

Inserting the estimates (j3J), © and (jSJ) into (J2J), we obtain the desired esti- 
mate in the case z > Y. 

Next, suppose that y < z < Y, and put 

v = logy = 1 log logy 
logy logy 

Since g(s) = 1 — log s for 1 < s < 2, we have 

log logy 



i > q(v) > e(v) = i + o 

therefore, 



logy 



g(v) - g(V) « (6) 



By partial summation, it follows that 

s( y ,z)= Yl i + s (y, y ) 



d 

z<d<Y 

P+(d)<y (7) 

+ logy / — ds + S[y,Y). 



y z Jv y 



Using Lemma n together with (jUJ), it follows that 

my) Hz,y)_ Q{v) _ g{v)+0 ( M <<; !o|logy 



Applying the estimate from the previous case, we also have 

S(y, Y) = t{V) log Y - 1Q {V) + O ( -L ) . (9) 
To estimate the integral in ((7j), we use Lemma again and write 



where 



d s = h + 0(h), 



h = I g(s)ds = r(v)-r(V), 

J V 

i r v iog(y/z) log logy 

h = i / as = — — 2 < - — g — • 

log?/ J v \og z y \og z y 



Therefore, 



— ds = t{v) - t(V) + O — — — . (10) 

V V log y J 

Inserting the estimates (jHJ), © and (JTUJ) into (J7J), and taking into account (JHJ), 
we obtain the stated estimate for y < z < Y. 
Finally, suppose that 1 < z < y. In this case, 

S(y,z)= k + S(y,y). (11) 



d 

z<d<y 



By partial summation, we have 



1 = logy - log z + O^- 1 ) = (l-v)logy + 0(z- 1 ] 



d 

z<d<y 



logy I g(s)ds + 0(z- 1 ) = (r(v)-r(l))\ogy + 0(z- 1 ) 

J V 
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Applying the estimate from the previous case, we also have 

log logy 



S(y,y) =r(l) logy -70(1) + O 



logy 



Inserting these estimates into (jTTjl . and using the fact that g(v) = g(l) = 1, 
we obtain the desired result. This completes the proof. □ 

Lemma 4. For fixed e > and uniformly in the domain 

x>3, y> exp{ (log log x) 5/3+6 }, 1 < z < x/y, 

we have 

^ Q( u u d) < C Bte (u, v) log(it + 1) + g(« - v)g(v) + g(u - 1), 

z<d<x/y 
P+(d)<y 

where u = (log x)/ logy, v = (log z)j logy, Ud = (log d)J logy for every 
integer d in the sum, and 



C g: g(u,v) = / g(u — s)g(s) ds. 

J V 

Proof. By partial summation, we have 

Q ^ U d — = S(y, x/y) - g(u - v)S(y, z) + J g'(u - s)S(y,y s ) ds. 



z<d<x/y 
P+(d)<y 



Lemma El implies that 

S(y,x/y) = r(u-l)logy + 0(g(u- 1)), 
S(y,z) = t(v) logy + 0(g(v)), 



and 



where 



I g'(u - s)S(y, y s ) ds = h logy + 0(I 2 ), 

J V 



h — I d{ u ~ S ) T ( S ) ds = g(u — v)t(v) — t(u — 1) + C giB (u, v), 



pu—l 

h= \g'(u — s)\g(s) ds. 

J V 



Finally, using the bound 

\g'(t)\<g(t)log(t+l) (t>l), 

we see that 

PU—l 

I 2 < \og(u + 1) / q{u - s)q(s) ds < C 8;e (u, v) \og(u + 1). 

J V 

Putting everything together, the result follows. □ 

3 Integers free of small prime factors 

In this section, we collect various estimates for the counting function y) 
of y-rough numbers: 

y) = #{n < x : P~{n) > y}. 

As usual, we denote by u(u) the Buchstab function; for u > 1, it is the unique 
continuous solution to the difference-differential equation 

(uw{u))' = u{u - 1) (u>2) (12) 

with initial condition 

uuo(u) = 1 (1 < u < 2). 

It is convenient to define w(ti) = for all u < 1 so that ()12|) is satisfied for 
u G R \ {1,2}, and we also define u'{u) by right-continuity at u = 1 and 
m = 2. For a discussion of the analytic properties of u>(u), we refer the reader 
to Chapter III.6] 

The next result follows from [HI Corollary 7.5, Chapter III. 6]: 

Lemma 5. For fixed e > and uniformly in the domain 

x>3, x > y > exp{(logloga;) 5/3+£ }, 
the following estimate holds: 

*{x, y) = (xu{u) - y) -f - + O (^f) , 

Cihy) \log yj 

where u = (log x) /logy, and C(l,y) = rip<y C 1 
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Lemma 6. For fixed e > and uniformly in the domain 

x>3, y > exp{(loglogx) 5/3+e }, 1 < z < x/y, 

we have 

z<d<x/y 
P+(d)<y 

where u = (log x)/ \ogy, v = (log z)j logy, Ud = (log d) / log y for every 
integer d in the sum, and E(y,z) is the error term of Lemma& 

Proof. By partial summation, it follows that 
^2 ~~~d ~ = S (yi x ly) -w(u-v)S(y,z) + J u'(u- s)S(y,y s )ds. 

z<d<x/y v 
P+(d)<y 

By Lemma El we have the estimates 

S(y,x/y) = t(u- l)logy -jg(u - 1) +0(E(y,x/y)) 

and 

S(y, z) = T(v)\ogy -7q(v) + 0(E(y,z)). 

Also, 

/ u'(u - s)S{y, y s ) ds = h log y - jl 2 + 0(I 3 ), 

J V 



where 



h = io'{u — s)t(s) ds = oj(u — v)r(v) — r(u — 1) + C^^u, v), 

J v 
fU—1 

h = j u'{u — s)q(s) ds = u{u — v)q(v) - g(u - 1) + C UjS r(u, v), 

J v 

u-l 

\u'(u- s)\E(y,y s )ds. 



logy 

Putting everything together, we see that the stated estimate follows from the 
bound 

E{y, x/y) + u(u - v)E{y, z) + I 3 < E{y, z). (13) 
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To prove this, observe that E(y,zi) <C E(y,z 2 ) holds for all z\ > z 2 > 1. 
Therefore, E(y,x/y) <C E(y,z), and 

I 3 -C — / \uj (u — s) \ as <C — . 

logy A logy 

Taking into account the fact that u(u — v) x 1, we derive the bound ()13|). 
and this completes the proof. □ 



4 Proof of Theorem U 

For fixed y, every positive integer n can be uniquely decomposed as a product 
n = de, where P + (d) < y and P~(e) > y. Therefore, 

e(x,y,z) = E 1= E $ (zMy) 

2<c(<:r e<x/d z<d<x 
P+(d)<y p-(e)>y P+{d)<y 

= V(x,y) - V(x/y,y) + ^ <&{x/d,y). 
Using Lemma ^ it follows that 



z<d<x/y 
P+(d)<y 



V(x, y) - ty(x/y, y) = g(u) x + O 

By Lemma El we also have 
®(x/d,y) 



g(u — 1) x 
logy 



z<d<x/y 
P+{d)<y 



Ej i' xuj(u - u d ) _ \ e 1 ( xg(u - u d ) 



z<d<x/y 
P+(d)<y 



d °J C(l,y) V dhg 2 y 



( ./ v-v uj(u — Ud) e 7 y r _ , . . T , (^) 



z<d<x/y 
P+(d)<y 



q(u - U d ) 



P+(d)<y 
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Applying Lemma Q again, we have 

C(l>2/) logy 

Inserting the estimates of Lemmas 0] and El into (|14j) , and making use of the 
trivial estimate 



g(u)logy 
log(v + 1) ' 



POO 

C e<e (u, v) log(it + 1) < logy / q(s) ds < 

J V 

it is easy to see that 

log y \ e^ x 

g(u)+C w>g {u,v) x Ix-tC/K^) ^ , +0{£(x,y,z)). 

To complete to proof, we use the estimate (see 0): 

C(l,y) = eUogy(l + exp{-c(logy) 3 / 5 }), 

which holds for some absolute constant c > 0, together with the trivial 
estimate 



max 



{C u , e (u,v),C u j(u,v)} < / 



logfu + 1) 



5 Cryptographic applications 

Suppose that two primes p and g are selected for use in the Digital Signature 
Algorithm (see, for example, [3]) using the following standard method: 

• Select a random m-bit prime q; 

• Randomly generate fc-bit integers n until a prime p = 2nq+l is reached. 

The large subgroup attack described in Section 3.2.2] leads one naturally 
to consider the following question: What is the probability r)(k,£, m) that n 
has a divisor s > q which is 2^-smooth? 

It is natural to expect that the proportion of those integers in the set 
{2 fc_1 < n < 2 k } having a large smooth divisor should be roughly the same 
as the proportion of integers in 

1 2*:-i <- n < 2 k : n — (p — l)/(2g) for some prime p = 1 (mod 2g)} 
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having a large smooth divisor. Accordingly, we expect that the probability 
r)(k,£,m) is reasonably close to 

9(2 fc , 2 e , 2 m ) - e(2 fc ~ 1 , 2 e , 2 m ) 

Theorem then suggests that 

rj(k, £, m) « 2 jp(fc, £, m) — — l,£,m), 

where 

1 C u3>e ,(k/£,m/£) 



p(k,£,m) = Q(k/e)+C U) , e (k/£,m/£) 



'log 2 



In particular, the most interesting choice of parameters at the present time 
is k = 863, £ = 80, and m = 160 (which produces a 1024-bit prime p), for 
which expect that 7/(863, 80, 160) w 0.09576. 
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